sha/keccak1600.c: subscribe more platforms for "complementing" optimization.

E.g. on MIPS64 it gives >20% improvement...

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8261)

diff --git a/crypto/sha/keccak1600.c b/crypto/sha/keccak1600.c
index c49c4b3a8ddd4e20f55bf145afbdd7cce52b1d4f..7aa07552d38fb392965658358ce78c2d5589b19e 100644 (file)
--- a/crypto/sha/keccak1600.c
+++ b/crypto/sha/keccak1600.c
@@ -25,7 +25,14 @@ void SHA3_squeeze(uint64_t A[5][5], unsigned char *out, size_t len, size_t r);
 # define KECCAK_2X      /* default to KECCAK_2X variant */
 #endif
 
-#if defined(__i386) || defined(__i386__) || defined(_M_IX86)
+#if defined(__i386) || defined(__i386__) || defined(_M_IX86) || \
+    (defined(__x86_64) && !defined(__BMI__)) || defined(_M_X64) || \
+    defined(__mips) || defined(__riscv) || defined(__s390__) || \
+    defined(__EMSCRIPTEN__)
+/*
+ * These don't have "and with complement" instruction, so minimize amount
+ * of "not"-s. Implemented only in the [default] KECCAK_2X variant.
+ */
 # define KECCAK_COMPLEMENTING_TRANSFORM
 #endif